Why a Maturity Level Analysis?
The secure operation of information technologies in companies is a complex process. Numerous technical, organizational, and personnel aspects must be considered, along with legal requirements for implementing specific cyber security measures. To comprehensively evaluate the current state of various concepts and their interaction within your IT infrastructure, we provide a well-founded maturity analysis. This maturity assessment identifies targeted optimization potential and uses a proven maturity model to help you strategically develop existing processes, derive improvements, and enhance efficiency and resilience in the long term.
Objective
Assessment of technical, organizational and personnel security measures per ISO/IEC 27001 with optimization roadmap.
Question
Do existing security measures meet the requirements of ISO / IEC 27001 and what other measures are necessary for successful certification?
Scope
Entire IT environment, defined sub-areas as well as company buildings / premises (locations)
Maturity Analysis Procedure: Methodology & Approach
The Maturity Level Analysis is based on comprehensive interviews with the IT and system managers, using detailed questionnaires, documentation reviews and site inspections. The applied assessment materials are proven in practice and comply with ISO/IEC 27001.
In more complex IT environments, the assessment is generally performed by two auditors with shared responsibilities for audit management, interviewing and response documentation.
It is recommended that the analysis is carried out in combination with a technical assessment (e.g. vulnerability analysis , penetration test , etc.)
Components of SCHUTZWERK Maturity Analysis: Assessment Areas & Criteria
The following areas are covered in the assessment:
- Management & organization
- Technology & operation
- BCM & emergency plan
- Physical security
- Contractual relationships
- Software development & maintenance (optional)
- Cloud computing (optional)
Maturity Analysis Results: Assessment & Action Plan
In addition to the presentation of results within the questionnaires and the identification of necessary measures and specific requirements, the results will also be displayed in radar charts which are ideal for a presentation on the current state of the information and IT security to the management.